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MEMORANDUM  FOR  AUDITOR  GENERAL,  DEPARTMENT  OF  THE  ARMY 

SUBJECT:  Audit  Report  on  Army  Research  Laboratory  Preparation  for  Year  2000 
(Report  No.  99-036) 


We  are  providing  this  draft  report  for  information  and  use.  We  considered 
management  comments  on  a  draft  of  this  report  when  preparing  the  final  report. 

Comments  from  the  Acting  Deputy  Assistant  Secretary  of  the  Army  for 
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Appendix  B  for  the  report  distribution.  The  audit  team  members  are  listed  inside  the 
back  cover. 
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for  Auditing 


Office  of  the  Inspector  General,  DoD 
Report  No.  99-036  November  13, 1998 


(Project  No.  8 AB -0030. 02) 

Army  Research  Laboratory  Preparation  for  Year  2000 
Executive  Summary 


Introduction.  This  report  is  one  in  a  series  being  issued  by  the  Inspector  General, 
DoD,  in  accordance  with  an  informal  partnership  with  the  Chief  Information  Officer, 
DoD,  to  monitor  DoD  efforts  in  addressing  the  year  2000  computing  problem. 
Information  technology  systems  have  typically  used  two  digits  to  represent  the  year, 
such  as  “98”  representing  1998,  to  conserve  electronic  data  storage  and  reduce 
operating  cost.  With  the  two-digit  format,  however,  the  year  2000  is  indistinguishable 
from  1900.  As  a  result  of  the  ambiguity,  computers,  associated  systems,  and 
application  programs  that  use  dates  to  calculate,  compares,  and  sort  could  generate 
incorrect  results  when  working  with  years  after  1999. 

Audit  Objectives.  The  overall  audit  objective  was  to  determine  whether  the  Army 
Research  Laboratory  is  adequately  preparing  its  information  technology  systems  to 
resolve  date-processing  issues  regarding  the  year  2000  computing  problem. 
Specifically,  the  audit  determined  whether  the  Army  Research  Laboratory  complied 
with  the  DoD  Year  2000  Management  Plan  and  the  Army  Year  2000  Action  Plan. 

Audit  Results.  The  Army  Research  Laboratory  has  not  completed  a  comprehensive 
inventory  of  information  technology  systems,  examined  ongoing  research  efforts  for  a 
potential  year  2000  impact,  and  reviewed  contracts  to  ensure  the  systems  are  year  2000 
compliant.  In  addition,  the  Army  Research  Laboratory  has  not  met  the  required 
timeframes  of  the  Army  Year  2000  Action  Plan  for  identifying  and  assessing  year  2000 
problems.  As  a  result,  the  Army  Research  Laboratory  cannot  ensure  that  information 
technology  systems  and  ongoing  research  efforts  will  not  have  year  2000  date¬ 
processing  problems. 

Summary  of  Recommendations.  We  recommended  that  the  Director,  Army  Research 
Laboratory,  complete  a  comprehensive  inventory  of  all  hardware,  software,  and 
firmware  as  required  by  Army  guidance;  review  all  information  technology  research 
efforts  for  the  potential  year  2000  impact;  and  review  all  contracts  for  inclusion  of  the 
year  2000  contract  provision. 

Management  Comments.  The  Acting  Deputy  Assistant  Secretary  of  the  Army  for 
Research  and  Technology  concurred  with  the  finding  and  recommendations.  See  Part  I 
for  a  summary  of  management  comments  and  Part  III  for  the  complete  text  of  the 
comments. 
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Part  I  -  Audit  Results 


Audit  Background 


Year  2000.  Because  of  the  potential  failure  of  computers  to  run  or  function 
throughout  the  Government,  the  President  issued  an  Executive  Order,  “Year 
2000  Conversion,”  February  4,  1998,  making  it  policy  that  Federal  agencies 
ensure  that  no  critical  Federal  program  experiences  disruption  because  of  the 
Year  2000  problem  and  that  the  head  of  each  agency  ensure  that  efforts  to 
address  the  Year  2000  problem  receive  the  highest  priority  attention  in  the 
agency. 

The  Secretary  of  Defense  issued  the  memorandum  “Year  2000  Compliance”  on 
August  7,  1998  and  stated  that  the  year  2000  computer  problem  is  a  critical 
national  Defense  issue.  He  also  stated  Military  Departments  will  be  responsible 
for  ensuring  that  the  list  of  mission-critical  systems  under  their  respective 
purview  is  accurately  reported  in  the  DoD  year  2000  database  effective 
October  1,  1998.  DoD  Components  must  report  and  explain  each  change  in 
mission-critical  designation  to  the  Office  of  the  Assistant  Secretary  of  Defense 
(Command,  Control,  Communications,  and  Intelligence)  within  1  month  of  the 
change. 

The  Deputy  Secretary  of  Defense  issued  the  memorandum  “Year  2000  (Y2K) 
Verification  of  National  Security  Capabilities”  on  August  24,  1998.  The 
memorandum  states  that  the  Chief  of  Staff  of  the  Army  must  certify  that  they 
have  tested  the  information  technology  and  national  security  system  year  2000 
capabilities  of  their  respective  Component’s  systems  in  accordance  with  the 
DoD  Management  Plan. 

Public  Law  105-271,  “Year  2000  Information  and  Readiness  Disclosure  Act,” 
October  19,  1998,  is  intended  to  encourage  the  disclosure  and  exchange  of 
information  about  computer  processing  problems,  solutions,  test  practices  and 
test  results,  and  related  matters  in  connection  with  the  transition  to  the 
year  2000. 

Department  of  the  Army  Year  2000  Action  Plan.  The  Army  Year  2000 
Action  Plan  (the  Army  Action  Plan)  implements  the  DoD  Management  Plan. 
The  Office  of  the  Director  of  Information  Systems  for  Command,  Control, 
Communications  and  Computers,  who  is  responsible  for  providing  assistance 
and  oversight  and  for  monitoring  the  progress  of  Army-wide  year  2000 
management  activities,  issued  the  Army  Action  Plan  to  outline  the  Army’s 
year  2000  management  strategy,  provide  guidance,  define  roles,  responsibilities, 
and  reporting  requirements,  and  lay  a  foundation  to  ensure  that  no  mission- 
critical  failure  occurs  due  to  year  2000  related  problems.  The  Army  Action 
Plan  allows  for  centralized  management  with  decentralized  execution  focusing 
on  critical  systems.  It  discusses  each  of  the  five  phases  identified  in  the  DoD 
Year  2000  Management  Plan  and  establishes  the  Army’s  target  completion  dates 
for  each  phase.  The  five  phases  are  discussed  as  follows: 
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•  Phase  I  -  Awareness.  Education,  initial  organization,  and  planning 
take  place.  Corporate  strategies  are  developed.  Year  2000  responsible 
officials  are  identified  and  educated  for  all  organizations  within  the 
Army.  System  users  and  owners  are  identified  and  educated.  Target 
completion  of  the  awareness  phase  was  December  1996. 

•  Phase  II  -  Assessment.  Determine  the  impact  of  the  year  2000  on  the 
organization’s  inventory  including  hardware,  software,  and  firmware, 
and  develop  acceptable  solutions;  estimate  resource  requirements  to 
accomplish  year  2000  solutions;  and  develop  contingency  plans. 

One  hundred  percent  of  the  systems  and  devices  are  inventoried  and 
analyzed  for  year  2000  compliance.  Target  completion  of  the 
assessment  phase  was  March  1997. 

•  Phase  HI  -  Renovation.  Correct  the  year  2000  problems  for  each 
system.  Target  completion  of  the  renovation  phase  was  September 
1998. 

•  Phase  IV  -  Validation.  Test  and  verify  the  correctness  of  the 
renovated  or  replaced  systems.  All  systems,  including  those  assessed  as 
having  no  year  2000  impact,  must  undergo  the  validation  process. 

Target  completion  for  the  validation  phase  is  December  31,  1998. 

•  Phase  V  -  Implementation.  Systems  are  folly  operational  after  being 
certified  as  year  2000  compliant.  Target  completion  date  is 
December  31,  1998. 

Army  Research  Laboratory.  The  Army  Research  Laboratory  (ARL)  is  a 
subordinate  command  of  the  Army  Materiel  Command  (AMC).  The  ARL 
conducts  broad-based  scientific  research  and  advanced  technological 
developments  for  increased  automation  of  land  warfare  material,  digital 
battlefields,  sensors,  and  software  engineering  and  database  technologies.  It  is 
organized  into  five  directorates  and  two  centers  conducting  research  and 
development  in  five  locations  throughout  the  United  States.  The  ARL  has 
cooperative  agreements  with  three  major  private  sector  components  in  technical 
subareas  of  digitization  and  individual  partnerships  with  universities  in  selected 
technical  areas. 


Audit  Objectives 

The  primary  audit  objective  was  to  determine  whether  ARL  was  adequately 
preparing  its  information  technology  systems  to  resolve  date-processing  issues 
for  the  year  2000  computing  problem.  Specifically,  the  audit  determined 
whether  ARL  had  complied  with  the  DoD  Year  2000  Management  Plan  and  the 
Army  Action  Plan.  Appendix  A  describes  the  audit  scope  and  methodology,  the 
results  of  the  management  control  program  review,  and  the  prior  audit 
coverage. 
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Status  of  the  Army  Research  Laboratory 
Year  2000  Program 

The  Army  Research  Laboratory  did  not  complete  a  comprehensive 
inventory  of  information  technology  systems,  did  not  examine  ongoing 
research  efforts  for  a  potential  year  2(X)0  impact,  and  did  not  review 
contracts  to  ensure  they  included  a  year  2000  compliant  clause.  In 
addition,  ARL  had  not  met  the  timeframes  for  identifying  and  assessing 
year  2000  problems  required  by  the  DoD  Year  2000  Management  Plan 
and  the  Army  Action  Management  Plan.  The  conditions  existed 
primarily  because  ARL  management  did  not  devote  sufficient  attention  to 
the  potential  year  2000  problem.  As  a  result,  ARL  cannot  yet  ensure 
that  its  information  technology  systems  and  ongoing  research  efforts  will 
not  have  year  2000  date-processing  problems. 


Awareness 


The  ARL  completed  the  awareness  phase  of  the  Army  Action  Plan,  although  not 
by  December  1,  1996,  as  required.  The  awareness  phase  was  to  identify  and 
educate  Army  organization  personnel,  as  well  as  system  users  and  owners,  on 
year  2000  concerns  and  to  demonstrate  upper-level  management  support  for 
individual  Army  organizations. 

The  ARL  began  its  year  2000  program  in  1996  with  the  Chief,  Automation 
Division  Corporate  Information  and  Computing  Center,  creating  a  website, 
which  contained  year  2000  system  certifications,  programs  to  determine 
year  2000  compliance,  patches  for  repairing  year  2000  computer  problems, 
bulletins  and  other  Government  and  industry  year  2000  information.  On 
March  2,  1997,  the  ARL  Director  designated  a  year  2000  Program  Manager  to 
be  responsible  for  all  year  2000  tasking;  generate,  collect  and  analyze  all 
responses  to  year  2000  surveys;  and  respond  to  all  year  2000  inquiries. 

In  a  March  3,  1997,  memorandum  to  all  ARL  personnel,  the  ARL  Director 
identified  the  year  2000  Program  Manager  and  emphasized  the  importance  of 
addressing  year  2000  efforts  at  ARL.  The  Director  requested  each  member  of 
the  ARL  workforce  to  work  with  the  year  2000  Program  Manager  and  identify 
and  fix  ARL  information  assets. 

In  May  1997,  the  year  2000  Program  Manager  developed  the  Year  2000  Action 
Plan,  which  provides  the  corporate  strategy  and  management  approach  to  the 
year  2000  problem.  The  ARL  Action  Plan  assigned  the  Director  of  the 
Corporate  Information  and  Computing  Center  with  the  overall  responsibility  for 
its  year  2000  effort. 
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Status  of  the  Army  Research  Laboratory  Year  2000  Program 


Li  July  1997,  ARL  designated  21  positions  whose  performance  standards  were 
modified  to  include  year  2000  responsibilities;  nine  positions  were  in  the 
Corporate  Information  and  Computing  Center,  eight  were  directors,  and  four 
were  managers. 

In  a  December  1997  memorandum,  the  Director  of  Corporate  Information  and 
Computing  Center  requested  directorates  to  designate  an  official  in  each 
directorate  to  be  responsible  for  coordinating  year  2000  actions.  However,  all 
directorate  year  2000  officials  did  not  take  an  active  role  in  coordinating, 
conducting,  and  assessing  year  2000  efforts  until  June  1998,  after  AMC 
re-emphasized  the  requirement  for  ARL  to  develop  an  inventory  of  all 
hardware,  software,  and  firmware  systems. 


Inventory  and  Assessment 

The  Army  Action  Plan  states  that  the  organization  must  determine  the  impact  of 
the  year  2000  on  the  organization’s  activities  during  the  assessment  phase.  It 
requires  the  assessment  phase  to  include  a  complete  inventory  of  all  hardware, 
software,  and  firmware  for  technical,  business,  and  infrastructure  areas,  and  all 
internal  and  external  system  interfaces;  requires  the  system  to  be  reviewed  for 
year  2000  compliance;  requires  organizations  to  develop  a  year  2000 
contingency  plan  for  noncompliant  systems;  and  requires  organizations  to 
identify  costs  associated  with  resolving  year  2000  problems.  The  Army  Action 
Plan  recommends  that  organizations  complete  the  assessment  phase  by  June  30, 
1997. 

The  ARL  did  not  develop  the  comprehensive  inventory  of  hardware,  software, 
and  firmware  systems  required  by  the  Army  Action  Plan.  Although  officials 
distributed  year  2000  questionnaires  for  an  initial  inventory  of  systems  and  an 
assessment  of  the  year  2000  impact  on  the  systems,  all  ARL  personnel  did  not 
respond  to  the  questionnaire. 

Inventory  Request  Response.  The  Director,  ARL,  issued  a  memorandum  on 
March  3,  1997,  that  requested  each  member  of  the  ARL  workforce  to  survey, 
inventory,  and  assess  each  information  asset  and  to  complete  an  attached  ARL 
year  2000  questionnaire  by  March  27,  1997.  Although  the  responses  identified 
12,631  systems  and  equipment,  less  than  50  percent  of  ARL  personnel 
responded.  At  the  time  of  the  audit,  ARL  was  conducting  a  comprehensive 
inventory  at  the  direction  of  AMC,  as  required  by  the  Army  Action  Plan. 

Assessment  of  Systems  and  Equipment.  The  ARL  officials  reported  to  AMC 
that  they  assessed  the  12,631  systems  and  equipment  identified  in  its  initial 
inventory.  Of  the  12,631  systems,  12,497  were  infrastructure  systems  (personal 
computers,  software  and  related  equipment),  107  were  weapon  and  scientific 
systems,  22  were  automated  information  systems  having  business  applications, 
and  5  were  facility  systems. 
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Status  of  the  Army  Research  Laboratory  Year  2000  Program 


Infrastructure:  Personal  Computers,  Software,  and  Related  Equipment. 
The  initial  assessment  of  the  12,497  personal  computer,  software  and  related 
equipment  of  ARL’s  infrastructure  identified  that  many  of  the  systems  were  not 
year  2000  compliant.  Undo:  direction,  guidance,  and  monitoring  by  AMC, 
ARL  started  to  make  the  computers  year  2000  compliant  with  a  computer  patch 
or  obtained  software-vendor-compliant  statements. 

Weapon  and  Scientific  Systems.  ARL  officials  inventoried  and 
assessed  107  scientific  systems  including  current  research  efforts  and  laboratory 
equipment  for  weapon  and  scientific  systems.  Seventy  of  the  systems  were 
commercial-off-  the-shelf  software  operating  on  five  types  of  supercomputer. 
ARL  officials  verified  that  the  software  and  supercomputers  were  compliant  by 
obtaining  year  2000  compliance  certifications  from  the  vendors.  The  remaining 
32  systems  are  composed  of  10  scientific  software  systems  and  22  classes  of 
laboratory  equipment  systems.  Officials  determinal  that  nine  of  the  scientific 
software  systems  were  year  2000  compliant  and  one  was  still  being  assessed. 
The  ARL  officials  determined  that  the  laboratory  equipment  was  either 
compliant,  was  not  date  dependent,  or  could  be  manually  adjusted. 

Automated  Information  Systems.  Of  the  22  systems  identified  as 
having  business  applications,  ARL  disposed  of  10,  replaced  6  as  normal  system 
upgrades,  and  will  make  6  systems  year  2000  compliant  at  an  estimated  cost  of 
$126,000. 

Facilities.  The  ARL  identified  five  facility  systems  that  include 
elevators,  water  meters,  environmental  control  systems,  cardkey  (badge) 
systems,  and  intrusion  detection  systems.  Three  of  the  five  facility  systems 
were  compliant  and  the  remaining  two  wore  noncompliant  (the  cardkey  and  the 
intrusion  detection  systems).  ARL  will  use  a  manual  key  system  if  the  planned 
replacement  cardkey  system  is  not  installed  in  time.  The  intrusion  detection 
system  was  still  being  assessed  by  ARL  officials;  however,  ARL  will  use  a 
security  force  if  the  system  is  not  compliant  by  December  31,  1999. 

ARL  officials  stated  that  an  additional  inventory  of  facilities  is  needed  because 
its  inventory  of  five  systems  may  not  be  all-inclusive. 

Test  Plan.  The  ARL  plans  to  test  computer  hardware  and  software,  weapon 
systems,  and  other  automated  or  microprocessor-controlled  research  and 
development  equipment  with  AMC-approved  year  2000  software  and  testing 
procedures,  which  are  included  in  the  AMC  year  2000  certification  checklist. 
The  AMC  requires  ARL  to  complete  the  checklists  as  part  of  the  certification 
process. 

Cost  Plan.  The  ARL  identified  limited  costs  associated  with  year  2000 
compliance  because  it  was  ARL  policy  to  maintain  the  latest  computer 
technology  systems.  The  cost  of  replacing  systems  was  considered  normal 
maintenance  costs.  ARL  officials  estimated  that  $126,000  would  be  necessary 
to  make  the  six  business  systems  year  2000  compliant. 

Mission  Criticality.  During  its  assessment  of  the  12,631  systems,  ARL 
officials  determined  that  it  had  no  mission-critical  systems;  however,  ARL 
needs  to  complete  its  inventory  and  assessments. 
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Status  of  the  Army  Research  Laboratory  Year  2000  Program 


Assessment  of  Current  Research  Projects.  The  ARL  did  not  assess  all 
ongoing  research  programs  and  their  potential  system  interfaces  or  the  systems 
to  which  the  research  programs  may  be  applied.  ARL  conducts  research  and 
development  programs  by  collecting,  transmitting,  and  processing  information 
to  improve  military  operations.  ARL  has  over  460  ongoing  research  projects, 
including  efforts  in  the  Information  Technology  Directorate.  ARL  identified 
10  scientific  software  systems  and  assessed  their  year  2000  impact. 

Management  officials  stated  that  program  managers  or  engineers  did  not 
examine  the  remaining  research  and  development  programs  because  ARL 
managers  believe  that  the  programs  are  too  early  in  the  development  process  to 
be  assessed  for  year  2000  compliance. 

The  need  to  assess  programs  and  their  interface  is  illustrated  in  the  Integrated 
Meteorological  System.  The  ARL  technicians  developed  software  for  die 
Integrated  Meteorological  System,  which  is  a  mobile,  tactical  weather 
forecasting  system  that  uses  dates  to  process  and  track  weather-related 
information  and  creates  messages  for  transmission.  When  Integrated 
Meteorological  System  Program  officials  questioned  whether  the  ARL- 
developed  software  was  year  2000  compliant,  an  official  stated  that  ARL 
developed  the  software  without  year  2000  considerations  and  ARL  cannot  verify 
that  software  already  delivered  has  no  year  2000  problem.  Subsequently,  an 
Integrated  Meteorological  System  contractor  tested  the  ARL-developed  software 
for  year  2000  compliance  and  did  not  identify  any  2000  issues.  However,  the 
hardware  still  has  problems  and  officials  planned  to  have  the  complete  system 
year  2000  compliant  by  December  1998.  The  Integrated  Meteorological  System 
illustrates  the  need  for  ARL  to  review  ongoing  research  for  potential  year  2000 
date-processing  problems  including  planned  system  interfaces. 


Contracting 

The  Acting  Assistant  Secretary  of  Defense  (Command,  Control, 

Communication,  and  Intelligence)  issued  a  policy  memorandum  to  the 
Secretaries  of  the  Military  Departments  and  the  Directors  of  the  Defense 
agencies  on  “Acquisition  of  Year  2000  Compliant  Information  Technology  (IT) 
and  Bringing  Existing  IT  into  Compliance,  ”  December  18,  1997.  The  policy 
states  that  all  information  technology  acquired  by  the  Military  Departments  and 
Defense  agencies  shall  be  year  2000  compliant.  The  memorandum  requires  the 
review  of  contracts  and  other  acquisition  instruments  for  information  technology 
equipment  to  determine  whether  modifications  are  necessary. 

Earlier,  the  Vice  Director,  Office,  Director  of  Information  Systems  for 
Command,  Control,  Communications  and  Computers,  Department  of  the  Army 
issued  a  September  11,  1996,  memorandum  that  requested  year  2000  language 
be  required  in  all  new  and  existing  information  technology  contracts. 

The  ARL  contracting  office  issued  175  contracts  for  a  22-month  period  ending 
July  1998.  We  randomly  selected  29  of  the  175  contracts  for  review  and 
determined  that  17  contracts  acquiring  information  technology  equipment  did 
not  include  the  year  2000  clause.  Contracting  officials  stated  that  they  did  not 
formally  review  all  information  technology  contracts  as  directed  in  the 
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December  18,  1997,  memorandum  from  the  Acting  Assistant  Secretary  of 
Defense  (Command,  Control,  Communication,  and  Intelligence).  ARL  should 
review  all  information  technology  equipment  contracts  to  determine  whether 
they  should  be  modified  for  the  year  2000  clause. 


Conclusion 

During  our  review,  ARL  was  conducting  an  inventory  of  all  hardware, 
software,  and  firmware  for  technical,  business,  and  infrastructure  areas  in 
response  to  a  specific  tasking  from  AMC.  In  a  memorandum  to  the  ARL 
Directorates,  the  Director  stated  that  AMC  concluded  that  Army  organizations 
applied  insufficient  attention  to  the  year  2000  problem.  We  agree  with  the 
AMC  assessment.  Although  ARL  completed  the  awareness  phase  satisfactorily, 
personnel  did  not  devote  timely  and  sufficient  attention  to  resolving  its 
year  2000  problem.  ARL  is  once  again  trying  to  develop  a  complete  inventory 
of  its  systems  and  perform  the  necessary  assessments.  ARL  needs  to  continue 
its  inventory  effort,  review  ongoing  research  efforts  for  a  potential  year  2000 
impact,  and  review  and  modify  existing  and  future  contracts  to  include  a 
year  2000  provision,  where  appropriate. 


Recommendations  for  Corrective  Action 

We  recommend  that  the  Director,  Army  Research  Laboratory: 

1.  Complete  and  assess  a  comprehensive  inventory  list  of  all  Army 
Research  Laboratory  hardware,  software,  and  firmware  items  for 

year  2000  compliance. 

Management  Comments.  The  Acting  Deputy  Assistant  Secretary  of  the  Army 
for  Research  and  Technology  concurred.  He  stated  that  the  ARL  will  conduct  a 
complete  inventory  and  assessment  by  January  1,  1999.  In  addition,  ARL  has 
established  a  management  oversight  and  quality  control  process  to  verify 
compliance  and  data  validity. 

2.  Review  all  information  technology  research  efforts,  including  any 
planned  system  interfaces,  to  determine  whether  they  have  a  potential 
year  2000  impact,  and  initiate  corrective  action. 

Management  Comments.  The  Acting  Deputy  Assistant  Secretary  of  the  Army 
for  Research  and  Technology  concurred.  He  stated  that  the  ARL  will  review  all 
research  programs  for  year  2000  compliancy  and  ARL  will  certify  the  software 
as  year  2000  compliant  when  passed  on  to  customers. 


8 


Status  of  the  Aimy  Research  Laboratory  Year  2000  Program 


3.  Review  all  existing  and  future  information  technology  contracts 
or  other  acquisition  instruments,  and  modify  contracts  for  year  2000 
compliance,  where  appropriate. 

Management  Comments.  The  Acting  Deputy  Assistant  Secretary  of  the  Army 
for  Research  and  Technology  concurred.  He  stated  that  the  ARL  identified 
about  180  contracts  that  needed  the  DoD-recommended  year  2000  language  and 
that  the  contracts  would  be  modified  by  October  16,  1998. 
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Appendix  A.  Audit  Process 


This  in  one  in  a  series  of  reports  being  issued  by  the  Inspector  General,  DoD,  in 
accordance  with  an  informal  partnership  with  the  Chief  Information  Officer, 
DoD,  to  monitor  DoD  efforts  to  address  the  year  2000  computing  challenge. 

For  a  listing  of  audit  projects  addressing  this  issue,  see  the  year  2000  webpage 
on  IGnet  at  < http://www.ignet.gov  > . 


Scope 

Work  Performed.  We  reviewed  and  evaluated  the  progress  of  ARL  in 
resolving  the  year  2000  computing  issue.  We  evaluated  its  year  2000  efforts 
compared  them  actions  with  the  Army  Action  Plan;  conducted  discussions  with 
technical,  business,  and  contracting  officials;  and  evaluated  year  2000 
documentation  where  available. 

DoD- Wide  Corporate-Level  Government  Performance  and  Results  Act 
Goals.  In  response  to  the  Government  Performance  and  Results  Acts,  the  DoD 
has  established  6  DoD-wide  corporate  level  performance  objectives  and  14  goals 
for  meeting  those  objectives.  This  report  pertains  to  achievement  of  the 
following  objective  and  goal: 

•  Objective:  Prepare  now  for  the  uncertain  future. 

•  Goal:  Pursue  a  focused  modernization  effort  that  maintains  U.S. 
qualitative  superiority  in  key  war-fighting  capabilities.  (DoD-3) 

DoD  Functional  Area  Reform  Goals.  Most  major  DoD  functional  areas  have 
also  established  performance  improvement  reform  objectives  and  goals.  This 
report  pertains  to  achievement  for  the  following  functional  area  objective  and 
goal: 

Information  Technology  Management  Functional  Area. 

•  Objective:  Provide  services  that  satisfy  customer  information  needs 

•  Goal:  Upgrade  technology  base.  (ITM-2.3) 

General  Accounting  Office  High  Risk  Area.  In  its  identification  of  risk  areas, 
the  General  Accounting  Office  has  specifically  designated  risk  in  resolution  of 
the  year  2000  problem  as  high.  This  report  provides  coverage  of  that  problem 
and  of  the  overall  Information  Management  and  Technology  high-risk  area. 
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Methodology 

Audit  Type,  Dates,  and  Standards.  We  performed  this  economy  and 
efficiency  audit  from  June  through  August  1998,  in  accordance  with  auditing 
standards  issued  by  the  Comptroller  General  of  the  United  States,  as 
implemented  by  the  Inspector  General,  DoD.  We  did  not  rely  on  computer- 
processed  data  or  statistical  sampling  procedures  to  develop  conclusions  on  this 
audit. 

Contacts  During  the  Audit.  We  visited  or  contacted  individuals  and 
organizations  within  DoD.  Further  details  are  available  on  request. 


Management  Control  Program  Review 

We  did  not  review  the  management  control  program  for  this  audit  because  the 
Secretary  of  Defense  Letter  of  Assurance  for  FY  1997  recognizes  the  year  2000 
issue  as  a  material  management  control  weakness  area. 


Summary  of  Prior  Coverage 


The  General  Accounting  Office,  the  Inspector  General,  DoD,  and  the  Army 
Audit  Agency  have  conducted  multiple  reviews  related  to  year  2000  issues. 
General  Accounting  Office  reports  can  be  accessed  over  the  Internet  at 
http://www.gao.gov.  Inspector  General,  DoD,  reports  can  be  accessed  over  the 
Internet  at  http://www.dodig.osd.mil.  However,  there  were  no  prior  reviews 
related  to  year  2000  at  the  Army  Research  Laboratory. 
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Office  of  the  Secretary  of  Defense 

Under  Secretary  of  Defense  for  Acquisition  and  Technology 
Director,  Defense  Procurement 
Director,  Defense  Logistics  Studies  Information  Exchange 
Under  Secretary  of  Defense  (Comptroller) 

Deputy  Chief  Financial  Officer 
Deputy  Comptroller  (Program/Budget) 

Assistant  Secretary  of  Defense  (Command,  Control,  Communications,  and  Intelligence) 
DoD  Year  2000  Oversight  and  Contingency  Planning  Office 
Assistant  Secretary  of  Defense  (Public  Affairs) 


Department  of  the  Army 

Commander,  Army  Materiel  Command 

Director  of  Information  Systems  for  Command,  Control,  Computers  and 
Communications 

Director,  Army  Research  Laboratory 
Chief  Information  Officer,  Army 
Inspector  General,  Department  of  the  Army 
Auditor  General,  Department  of  the  Army 

Department  of  the  Navy 

Assistant  Secretary  of  the  Navy  (Financial  Management  and  Comptroller) 
Chief  Information  Officer,  Navy 
Inspector  General,  Department  of  the  Navy 
Auditor  General,  Department  of  the  Navy 


Department  of  the  Air  Force 

Assistant  Secretary  of  the  Air  Force  (Financial  Management  and  Comptroller) 
Chief  Information  Officer,  Air  Force 
Inspector  General,  Department  of  the  Air  Force 
Auditor  General,  Department  of  the  Air  Force 


Other  Defense  Organizations 

Director,  Defense  Information  Systems  Agency 

Inspector  General,  Defense  Information  Systems  Agency 
Director,  National  Security  Agency 

Inspector  General,  National  Security  Agency 
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Non-Defense  Federal  Organizations  and  Individuals 

Office  of  Management  and  Budget 

Office  of  Information  and  Regulatory  Affairs 

Technical  Information  Center,  National  Security  and  International  Affairs  Division, 
General  Accounting  Office 

Director,  Defense  Information  and  Financial  Management  Systems,  Accounting  and 
Information  Management  Division,  General  Accounting  Office 

Chairman  and  ranking  minority  member  of  each  of  the  following  congressional 
committees  and  subcommittees: 

Senate  Committee  on  Appropriations 

Senate  Subcommittee  on  Defense,  Committee  on  Appropriations 

Senate  Committee  on  Armed  Services 

Senate  Committee  on  Governmental  Affairs 

Senate  Special  Committee  on  the  Year  2000  Technology  Problem 

House  Committee  on  Appropriations 

House  Subcommittee  on  National  Security,  Committee  on  Appropriations 
House  Committee  on  Government  Reform  and  Oversight 
House  Subcommittee  on  Government  Management,  Information,  and  Technology, 
Committee  on  Government  Reform  and  Oversight 
House  Subcommittee  on  National  Security,  International  Affairs,  and  Criminal 
Justice,  Committee  on  Government  Reform  and  Oversight 
House  Committee  on  National  Security 
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Department  of  the  Army  Comments 


ATTENTION  OP 

SARD-TR 


DEPARTMENT  OF  THE  ARMY 
OFFICE  OF  THE  ASSISTANT  SECRETARY 
RESEARCH  DEVELOPMENT  AMO  ACQUISITION 
103  ARMY  PENTAGON 
WASHINGTON  DC  20310-0103 


OCT  m 


MEMORANDUM  FOR  INSPECTOR  GENERAL,  DEPARTMENT  OF  DEFENSE 
(AUDITING),  400  ARMY  NAVY  DRIVE  (ROOM  801), 
ARLINGTON,  VA  22202-2884 

SUBJECT:  Draft  Audit  Report  on  Army  Research  Laboratory  Preparation  for 
Year  2000  (Project  No.  8AB-0030.02) 


Reference  DoD  IG  Memorandum,  18  September  1998,  SAB. 

The  subject  report  and  the  Headquarters,  U.S.  Army  Materiel  Command 
response  (see  Enclosure)  have  been  reviewed  by  this  agency.  This  office 
concurs  with  the  Major  Command  position  on  the  audit,  including  the  actions 
being  taken  by  the  Army  Research  Laboratory  in  response  to  the  audit’s 
recommendations. 


Point  of  contact  for  this  action  is  Dr.  Thomas  Killion ,  (703)  601-1535,  i 
mail:  killiont@sarda.annv.mil. 


A.  Michael  Andrews  II 
Acting  Deputy  Assistant  Secretary 
for  Research  and  Technology 


Enclosure 

CF: 

ARMY  AUDIT  AGENCY  (MS.  RINDERKNECHT) 


Department  of  the  Army  Comments 


DEPARTMENT  OF  THE  ARMY 
HEADQUARTERS,  US.  ARMY  MATERIEL  COMMAND 
5001  EISENHOWER  AVENUE.  ALEXANDRIA,  V A  J23M-  0001 


RtH-VIO  .. 
»ntxno«o» 


WiCIR-A  (36-2a) 


28  October  1998 


MEMORANDUM  FOR  MR.  J.  M.  ANDREWS,  PROGRAM  DIRECTOR, 

ORGANIZATIONAL  EFFECTIVENESS,  U.S.  ARMY  AUDIT 
AGENCY,  3101  PARK  CENTER  DRIVE,  ALEXANDRIA,  VA 
22302-1596 

SUBJECT:  DODIG  Draft  Report,  Army  Research  Laboratory 
Preparation  for  Year  2000,  Project  AB-0030.02  (AMC  No.  D9819) 

1.  We  are  enclosing  our  position  on  subject  report  IAW  AR  36-2. 
We  concur  with  the  actions  taken  by  U.S.  Army  Research 
Laboratory. 

2.  Point  of  contact  for  this  action  is  Mr.  Robert  Kurzer, 

(703)  617-9025,  e-mail  -  bkurzer8hgamc.army.mil. 

3.  AMC  —  America's  Arsenal  for  the  Brave. 

FOR  THE  COMMANDER: 


(NORMAN  E.  WILLIAMS 
Wjor  General,  USA 
Chief  of  Staff 
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DEPARTMENT  OF  THE  ARMY 

VIMTSD  STATU  AJWV  MMAMfeUMMATOKT 
Mt  Mnta  MLL  MAO 
AOC1MI,  UMTUMB  M>U>1 1  (7 


AMSRL-TR  (36-2b) 


1 3  OCT  ISP" 


MEMORANDUM  FOR  Commander,  U.S.  Army  Materiel  Command,  ATTN:  AMCIR-A 
$001  Eisenhower  Avenue,  Alexandria,  VA  22333-0001 

SUBJECT:  DODIG  Draft  Report,  Army  Research  Laboratory  Preparation  for  Year  2000. 
Project  SAB-0030.02  (AMC  No.  09*19) 


1.  Reference  memorandum,  HQ  AMC,  AMCIR-A,  1  Oct  98,  SAB. 

2.  The  subject  report  has  been  reviewed  by  responsible  personnel  at  the  Army  Research 
Laboratory.  Our  response  end  proposed  position  on  the  finding  and  recommendations  in  the 
report  are  enclosed 

3.  POC  for  this  information  is  Mr.  Robert  Davis  on  DSN  290- H  98  or  COMM  (301)  394-149*. 


if-  * 


'T0HNW.  LYONS 
Director 


AMSRL-DD  (Dr.  J.  Rocchio) 
AMSRL-CI  (Mr.  C.  Nietubiea) 
AMSRL-CS  (COL  K.  Logan) 
AMSRL-CS-PR  (Mr.  R.  Tomko) 


ash.  .  a  national  ^invention  laboratory 
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Department  of  the  Army  Comments 


U.  S.  ARMY  RESEARCH  LABORATORY 
COMMAND  REPLY 

DOD1G  Audit  on  Army  Research  Laboratory  Preparation  for  Year  2000 

Finding;  The  Army  Research  Laboratory  did  not  complete  a  comprehensive 

inventoiy  of  information  technology  systems,  did  not  examine  ongoing 
research  efforts  for  a  potential  year  2000  impact,  and  did  not  review 
contracts  to  ensure  they  included  a  year  2000  compliant  clause.  In 
addition,  ARL  has  not  met  the  timeframes  for  identifying  and  assessing 
year  2000  problems  required  by  the  DoD  Year  2000  Management  Plan  and 
the  Army  Action  Management  Plan.  The  conditions  existed  primarily 
because  ARL  management  did  not  devote  sufficient  attention  to  the 
potential  year  2000  problem.  As  a  result,  ARL  cannot  ensure  that  its 
information  technology  systems  and  ongoing  research  efforts  will  not  have 
year  2000  date-processing  problems 

Additional  Facts:  The  Army  Research  Laboratory  did  have  an  inventoiy  in  May  1998  that, 

while  not  wall  to  wall,  was  sufficiently  complete  to  allow  an  assessment  of 
ARL’s  readiness  to  deal  with  Year  2000.  ARL  concentrated  on  looking  at 
and  addressing  the  systems  that  ware  mission  essential  and  chose  to  expend 
its  limited  resources  there.  This  fit  the  DOD  model  of  applying  business 
judgement  to  mitigating  the  Y2K  problems.  While  ARL  is  now  performing 
an  even  more  detailed  inventoiy  per  ihe  direction  of  AMC,  the  expected 
outcome  in  terms  of  Y2K  problems  important  to  the  laboratory  are 
expected  to  remain  the  same  and  allow  ARL  to  cross  the  Y2K.  boundary 
with  few  if  any  problems.  AU  major  systems,  including  research  projects 
likely  to  result  in  hand-off  of  software  to  soldiers  or  others  were 
inventoried  and  assessed.  ARL  transfers  research  products  by  inserting  it’s 
software/systems  into  integration  projects  (e.g.,  Advanced  Technology 
Demonstration  (ATDs))  with  the  research  and  engineering  centers.  ARL 
did  review  contracts  when  information  technology  was  a  deliverable  item 
but  understood  the  scope  of  action  to  be  more  limited  than  the  DoD  IG 
did.  There  were  many  fitters  in  the  external  and  internal  environment 
which  contributed  to  conditions  found  by  the  DoD  IG.  Confusing  and 
changing  guidance,  a  tendency  to  assign  the  same  priority  to  all  facets  of 
the  problem  were  external  factors  which,  when  combined  with  internal 
management  difficulties  associated  with  the  retirement  of  the  CIO  led  to 
less  than  stellar  performance.  ARL  management  has  put  into  action  a  high 
priority  program  which  will  overcome  these  previous  difficulties  and 
deliver  a  sound  solution  to  the  Y2K  issue. 

Recommendation  1 ;  Complete  and  assess  a  comprehensive  inventoiy  list  of  all  Army  Research 
Laboratory  hardware,  software,  and  firmware  items  for  year  2000 
compliance. 


Action  Taken: 


Recommendation  2; 


Action  Taken: 


Recommendation  3: 


Action  Taken. 


Concur.  ARL  has  (i)  developed  a  comprehensive  database  to  inventory 
and  track  compliance  and  manage  future  YzK  related  actions  as  welt  as 
information  assurance  issues  which  are  growing  in  importance;  (ii)  initiated 
a  complete  reinventoty  and  assessment  of  all  YZX  related  hardware  and 
software;  (Hi)  put  in  place  a  management  oversight  process  with  a  dear 
chain  of  responsibility  and  audit;  and  (iv)  put  in  place  a  quality  control 
(TRAC)  process  to  verify  compliance  and  validity  of  data.  This  review  is  to 
be  completed  by  1  Jan  1999. 

Review  all  information  technology  research  efforts,  including  any  planned 
system  interfaces,  to  determine  whether  they  have  a  potential  year  2000 
impact,  and  initiate  corrective  action. 

Concur.  All  research  programs  will  be  reviewed  again  for  Y2K  compliance 
issues.  Further,  ARL  will  certify  their  software/systems  as  Y2K  compliant 
when  research  projects  are  completed  and  passed  on  to  customers. 

Review  all  existing  and  future  information  technology  contracts  or  other 
acquisition  instruments,  and  modify  contracts  for  year  2000  compliance, 
where  appropriate. 

Concur.  All  existing  ARL  contracts  have  been  reviewed  for  Y2K 
compliance  by  ARL  technical,  information  technology  and  administrative 
personnel.  As  a  result,  we  have  identified  approximately  1 80  contracts 
needing  the  DOD  recommended  Y2K  language.  We  ere  currently  in  the 
process  of  modifying  these  contracts.  We  expect  to  have  all  modifications 
mailed  to  contractors  by  16  Oct  98.  Since  these  will  be  bilateral 
modifications  requiring  contractor  signature,  we  expect  to  have  everything 
finalized  by  30  Oct  91, 
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Audit  Team  Members 

The  Acquisition  Management  Directorate,  Office  of  the  Assistant  Inspector 
General  for  Auditing,  DoD,  produced  this  report. 

Thomas  F.  Gimble 
Patricia  A.  Brannin 
Raymond  A.  Spencer 
Roger  H.  Florence 
Robin  G.  McCoy 
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